Importing DISA Stigs on air gapped network

How to get Disa STIGS onto SolarWinds?

When I download a Stig off Disa it is an xml file, but it doesn't keep the xml tree format so when I try to upload that to SolarWinds it says that it is not the correct format.

From my understanding, Ill still have some leg work to do once that the stigs are in SW, ill still have to likely write out the remediation in the rules or modify the rules but I'm struggling to just get these uploaded to SW.

Our network is air gapped which makes it more difficult to import from Thwack.

Is there a PowerShell script to get these stigs into the correct xml format solarwinds is wanting? or Any Solution you have found?

Ive seen @CourtesyIT 's listing of stigs but and my IA people may be able to get those for me if needed, but my question still stands, will I be able to just import those directly into the "admin>settings>NCM settings>manage policy reports ?

Thanks in Advanced!

Find more posts tagged with

disa stigs

federal_government

disa_stig_compliance_reports_checklist

dod

ncm

Compliance

federal

Accepted answers

All comments

mesverrum

Looks like you have a mistake in your understanding, Solarwinds can't just ingest a STIG XML file directly and automagically turn that into a set of checks and rules. The rules that @CourtesyIT makes were created by hand based on his expertise working in Fed environments and then he exported and uploaded the files that Orion uses for the rules he came up with.

There's no Powershell to automatically do that work, it was a human process and he has allowed the community to piggy back off his efforts. If you get approved to use them then yes, you just get those files onto your computer and then use the Manage Policy reports and import option.

documentation.solarwinds.com/.../ncm-import_export_policy_reports.htm

JessHaert

I appreciate it, but prior to DISA changing the file/format of the STIG file you were able to upload the whole report which created the policy and rules, because it was in the correct` XML format. There might have been some leg work after they were in Solarwinds but I didnt have to hand jam a rule for every stig, they were just imported. So I was just wondering if anyone had a quick fix for the new format for stigs. The file still shows XML but its a xccdf file, it plays nice with STIG VIEWER now but solarwinds doesn't like it anymore.

if it was only a few changes I'd happily hand jam but the problem is I inherited a STIG nightmare, needs quite a lot of updating.

mesverrum

I'm pretty certain about this, I've worked in person with @CourtesyIT on these kinds of projects before. Here are some links going back years asking essentially asking and answering the same question you are.

Latest instructions - Everything DISA STIGs for your Network - The Next Generation

8 year old instructions to prove that even back then it wasnt an automatic creation from STIG the doc - Everything DISA STIGs for your Network

And the man himself explaining to someone how they can't just import the STIG xml as its published. - STIG reports import

The process never was that NCM could ingest STIG files directly into NCM and it would automatically create the rules and reports. It has always been that a generous community member had reviewed the STIG files and was uploading the policies he created by hand to Thwack for community use. His work has made it appear seamless for a lot of users, but its important to understand his contribution since without that understanding you are looking for a way to do these that doesn't exist.

chuckusfourus

@JessHaert @mesverrum I have set up a feature request to show that there is a requirement for a better process for STIGs.
[mention:5bc1097e058348c9a3bc5fe6924aa29b:fb5d84b10a5745448a7a45dafc1faa43]

Please show your support!